bvandeusenandClaude Opus 5.5
5569f9934e
#5740 "A metric that departs from its normal is recorded as an anomaly to review, and is findable after it ends", milestone 513. - Every minute each learned key's last 15 minutes is judged against its hour's normal: above the usual hold x1.25 and by the metric's floor opens an occurrence, which ends when the level comes back. - metric_anomalies holds one row per item to review; a repeat while it still waits joins it as an occurrence (metric_anomaly_spans). - An ended row nobody reviews within anomalies.review_days (14, Settings -> Thresholds) lapses; an ongoing one never does. - Learning skips every hour an occurrence covers unless its anomaly was marked normal: no normal is learned without review. - Alerts -> Anomalies lists those to review first, then the reviewed and lapsed under day dividers; marking is operator/admin and audited. - The Overview widget and get_overview warn of open ones and count those to review; the host page shows its own; the weekly report lists the week's and the lapsed; MCP list_anomalies and review_anomaly. - Reviewed and lapsed rows are pruned at data.retention_days, and kept in backups like alert history. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
51 lines
2.5 KiB
Python
51 lines
2.5 KiB
Python
"""What a backup carries. Every table Steward defines is named here as kept
|
|
or left out, and tests/core/test_backup_contents.py fails on one that is
|
|
neither, so a new table is a decision someone makes in this file.
|
|
|
|
The operator's ruling (System 180 "Backup & Restore", 2026-10-12): a backup
|
|
carries configuration, the audit log and alert history. Metrics, check
|
|
results and the Docker, Traefik and UniFi history are left out: their tables
|
|
come back with their structure and no rows, and fill again as Steward runs.
|
|
|
|
A table that is in neither list (an external plugin's) is backed up whole:
|
|
a table nobody thought about is kept, never lost.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
# Configuration, and the history the operator chose to keep.
|
|
KEPT: frozenset[str] = frozenset({
|
|
"app_settings", "users", "user_invites", "api_tokens",
|
|
"hosts", "host_agent_registrations",
|
|
"monitors",
|
|
"alert_rules", "alert_states", "maintenance_windows",
|
|
"ansible_targets", "ansible_groups", "ansible_target_groups", "ansible_schedules",
|
|
"dashboards", "dashboard_widgets", "dashboard_share_tokens",
|
|
"snmp_devices", "prometheus_targets", "prometheus_widget_templates",
|
|
# Names given to network clients by hand (UniFi's alias column).
|
|
"unifi_known_clients",
|
|
# History kept by the ruling.
|
|
"audit_events", "alert_events",
|
|
# Metric anomalies and their reviews (#5740): what someone marked normal
|
|
# or real is a decision, kept like alert history.
|
|
"metric_anomalies", "metric_anomaly_spans",
|
|
})
|
|
|
|
# Rows that are measurements, logs or in-flight work: left out.
|
|
EXCLUDED: frozenset[str] = frozenset({
|
|
"plugin_metrics", "plugin_metric_latest", "plugin_metrics_hourly",
|
|
# Learned from the metrics above, so relearned once they fill again.
|
|
"metric_norms",
|
|
"monitor_results",
|
|
"email_outbox", "email_outbox_events", "password_resets",
|
|
# Run history; its logs live on disk, not in the database.
|
|
"ansible_runs",
|
|
"docker_containers", "docker_disk_usage", "docker_events", "docker_host_status",
|
|
"docker_images", "docker_logs", "docker_metrics", "docker_metrics_hourly",
|
|
"docker_swarm_nodes", "docker_swarm_services",
|
|
"traefik_access_summaries", "traefik_certs", "traefik_global_stats", "traefik_metrics",
|
|
"traefik_status_codes",
|
|
"unifi_alarms", "unifi_client_snapshots", "unifi_devices", "unifi_dpi_snapshots",
|
|
"unifi_events", "unifi_fw_rules", "unifi_networks", "unifi_port_forwards",
|
|
"unifi_speedtest_results", "unifi_wan_stats", "unifi_wlan_stats",
|
|
})
|